The EU General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is a new law that regulates how the personal data of EU citizens can be collected, used, and processed by businesses including sole traders like myself.

This takes effect on May 25, 2018, and while it’s being implemented by the European Union, it applies not only to organizations based in the EU but also to those that have customers and contacts in the EU.

Having been in business for a decade I’ve accumulated a lot of client data, even Google logins and website access as well as personal information from emails, to mobile numbers and personal and business addresses.

I don’t store data older than 12 month on my computer or in Google Cloud, all data is exported onto an external hard drive in the event a lapsed client should get back in content and require forgotten access to their accounts, images and so on. Even though this means your data is offline on a secure password protected device, this means as of May 25th this year I need express permission from all clients past and present to store this information.

The EU’s General Data Protection Regulation (GDPR) will apply from 25 May 2018, when it supersedes the UK Data Protection Act 1998. Significant and wide-reaching in scope, the new law brings a 21st century approach to data protection. It expands the rights of individuals to control how their personal information is collected and processed, and places a range of new obligations on organisations to be more accountable for data protection.

Compliance is not a choice and time is short

GDPR compliance is not just a matter of ticking a few boxes; the Regulation demands that you be able to demonstrate compliance with the data protection principles. This involves taking a risk-based approach to data protection, ensuring appropriate policies and procedures are in place to deal with the transparency, accountability and individuals’ rights provisions, as well as building a workplace culture of data privacy and security.

With the appropriate compliance framework in place, not only will you be able to avoid significant fines and reputational damage, you will also be able to show customers that you are trustworthy and responsible, and derive added value from the data you hold.

Brexit and the GDPR

UK organisations handling personal data will still need to comply with the GDPR, regardless of Brexit. The GDPR will come into force before the UK leaves the EU, and the government has confirmed that the Regulation will apply, a position that has been stated by the Information Commissioner’s Office (ICO).

The new Data Protection Bill going through Parliament will transpose the GDPR into UK law, and will continue to apply post-Brexit. The Bill also includes a number of agreed modifications to the GDPR in areas such as academic research, financial services and child protection. Learn more >>

Post-Brexit any cross-border data flows between the EU and the UK may no longer carry automatic adequate safeguards. Accordingly, the UK Government is seeking an ‘adequacy decision’ from the EU to continue to share personal data. If this is not forthcoming, other options include seeking a bilateral agreement similar to the EU-US Privacy Shield, or for organisations to implement standard contract clauses or binding corporate rules that would add complexity and cost to data transfers. International organisations should consider Brexit implications in their GDPR planning.

The key elements of the GDPR

Personal data

The GDPR applies to personal data. This is any information that can directly or indirectly identify a natural person, and can be in any format.

The Regulation places much stronger controls on the processing of special categories of personal data. The inclusion of genetic and biometric data is new.

Personal data

Name

Address

Email address

Photo

IP address

Location data

Online behaviour (cookies)

Profiling and analytics data

Special categories of personal data

Race

Religion

Political opinions

Trade union membership

Sexual orientation

Health information

Biometric data

Genetic data

Wider scope

The GDPR applies to all EU organisations – whether commercial business, charity or public authority – that collect, store or process the personal data of individuals residing in the EU, even if they’re not EU citizens.

Organisations based outside the EU that offer goods or services to EU residents, monitor their behaviour or process their personal data will be subject to the GDPR.

Service providers (data processors) that process data on behalf of an organisation come under the remit of the GDPR and will have specific compliance obligations. An example might be a company that processes your payroll or a Cloud provider that offers data storage.

Data protection principles

Personal data must be processed according to the six data protection principles:

Processed lawfully, fairly and transparently.

Collected only for specific legitimate purposes.

Adequate, relevant and limited to what is necessary.

Must be accurate and kept up to date.

Stored only as long as is necessary.

Ensure appropriate security, integrity and confidentiality

Accountability and governance

You must be able to demonstrate compliance with the GDPR:

The establishment of a governance structure with roles and responsibilities.

White Label SEO

White label SEO services for UK web development agencies.

I'm happy to represent your company with your domain email, or work completely anonymous behind the scenes on a freelance basis.
£50 referral bonus - if you introduce me to a new client who books my 30 Day SEO Booster I'll send you £50 as a thank you.

SEO Training

Learn bang up to date SEO methods in-house with a full 8-hour Day Course from £700. Linkbuilding included.

60-minute Skype and Telephone SEO Training sessions - pay by Paypal via my website to book in consultations with a Google audit. Contact me in advance to book your date in my diary.